The present invention relates to a method for operating a transponder.
Nowadays transponders are offered in various embodiment forms. For various applications passive transponders, also called identification tags or tags are used. These serve the identification of objects as well as also for security from theft.
Passive transponders for security from theft are for example fastened on pieces of clothing. Such tags are known as EAS tags (electronic article surveillance). These consist for example of a coil and of a capacitance which together form a resonant circuit. From a base station (also called read apparatus) the resonant circuit is excited into oscillation and its answer signal is detected. Thus the presence or the absence of a transponder may be ascertained, transponders with differing resonance frequencies may be differentiated from one another
On purchase the transponder is inactivated in order with objects which leave the place of purchase to render possible the differentiation between xe2x80x9cpaidxe2x80x9d and xe2x80x9cnot paidxe2x80x9d and in the case of the latter for an alarm to be made. For the inactivation it is sufficient to create a significant change in the resonant circuit. Such a change may for example lie in shorting the coil or destroying the resonance capacitor. Also by way detuning the resonant circuit or by way of other irreversible measures the transponder may be inactivated.
For the sake of clarity it is to be mentioned here that one in principle must differentiate between to inactivate and to deactivate. With the inactivation the transponder is brought into a condition in which it is irreversibly no longer capable of operation. To deactivate is in contrast to be understood as reversibly bringing the transponder from an active status into and idle status in order when desired to bring it again into the active status.
Furthermore there are known transponders which function with an emitter which is activated in a read field of a base station and data is transferred to the base station. Such RF-ID (Radio Frequency IDentification) transponders are somewhat more complex and comprise mostly two main elements, specifically an integrated circuit board and an antenna. The RF-ID transponders may be deactivated by way of the transfer and storing of suitable data. If the deactivated integrated circuit board is inquired by a base station then it will no longer transfer any data to the base station.
In the document JP-01 251 937 A there is disclosed a method which is to ensure that a signal transmitted from a first transfer station is received by a second transfer station. If from the second transfer station there is received a signal then this answers with a repeated sending of a confirmation signal to the first transfer station. By way of the repeated sending it is ensured that the confirmation signal also with a difficult or disturbed transfer reaches the first transfer station, by which means there is achieved a secure communication.
From the document WO 99/05658 Al there is known a method for operating an RF-ID transponder, according to which to each transponder belonging to a base station there is allocated unambiguous identification information. This identification information is stored in the transponder as well as in a database which may be called up by the base station. As soon as the base station has ascertained a transponder in its active field, it inquires its identification information and compares this to the information stored in the database. Only when the identification information agrees does the base station transmit a deactivation command to the transponder. By way of this the base station ensures that it only deactivates those transponders which are allocated to it. With this method however it may not be prevented that a transponder is deactivated and reactivated in an unauthorized manner; the transponder accepts in every case a command signal sent from the base station.
A problem results e.g. with the EAS transponders as well as with the RF-ID transponders, in the case that the purchased good with the inactivated or deactivated transponder again comes back to the sales location, e.g. for the purpose of exchange. In this case the transponders must again be activated, e.g. to control the flow of goods. With inactivated EAS tags this is usually not possible; the resonant circuits which have been irreversibly destroyed or inactivated with the sale may not be reactivated.
RF-ID transponders behave in a different manner. Most of these transponders may be reactivated. For this the RF-ID transponder is brought into the transmitting range of the read apparatus and by way of a suitable activation signal is again transposed into the active condition. Problematic is however the fact that such RF-ID transponders may be deactivated and reactivated by any one at any time if the corresponding command signal is known. Since the identification signal is freely transferred from the base station to the transponder, it may be determined without any problem by which means there is no longer any protection. The unauthorised deactivation must not be possible because this makes theft possible. The unauthorised reactivation is undesired for reasons of protection of the person. Inactivated transponders should under no circumstances be reactivated in an unauthorised manner and be able to be used for following the marked goods respectively their owner.
It is the object of the present invention to put forward a method with which transponders are reliably deactivatable respectively reactivatable only by suitably authorised base stations and their operators.
This object is achieved by a method that ensures that the deactivation signal/reactivation signal respectively is not accepted before the authorization of the base station for the deactivation/reactivation respectively is checked. This checking is carried out by the transponder by way of an admission signal from the base station.
According to the invention the transponder comprises a data memory and means for the contactless, in particular electrical, magnetic or electromagnetic interaction with a base station. The transponder is brought into an active field of the base station and by the base station is deactivatable respectively activatable by way of the transfer of a command signal. Before the deactivation respectively activation of the transponder the authorisation of the base station for deactivation respectively reactivation is checked in that from the base station before the transmission of the command signal, an admission signal which contains first admission information is transferred to the transponder, the admission signal is received by the transponder and the first admission information with second admission information stored in the data memory by the transponder is processed into authorisation information. On account of the thus obtained authorisation information in the transponder it is decided whether the command signal is accepted or rejected. In the first case the transponder may be deactivated respectively activated.
In contrast to the above discussed method known from the state of the art the method according to the invention functions with a mere one-sided transfer. In the simplest embodiment form only the base station sends signals to the transponder, and in contrast does not require an answer from the transponder. For this reason the method according to the invention is simple and reliable.
As a first and second admission information preferably at least one secret key which is not publically accessible is used. The method according to the invention may use asymmetrical keys and suitable computation rules. In this case e.g. in the base station there is present a xe2x80x9cpublic keyxe2x80x9d and in the transponder a xe2x80x9cprivate keyxe2x80x9d.
It may be advantageous when the base station and the transponder in the active condition also before the exchange of the admission signals may exchange protected data.
Also when the transponder is located in the read field of the base station there may occur transmission malfunctioning. It may therefore be advantageous when the base station, after sending the command signal which sets the transponder in the idle status, emits a control signal which would be answered by the non-deactivated transponder, and that the base station would display an answer thereto as a warning signal. Thus the base station may ascertain whether the transponder has actually been transposed into the idle status, and where appropriate when this has not been effected repeat the procedure in order to transpose the transponder into the desired idle status. The answer of the transponder could lie in a slightly extended realisation of a confirmation signal of the deactivation/reactivation command.
In order to obtain as little as possible erroneous displays, the base station and transponder in dialogue may repeat the deactivation procedure once or several times, and only after an unsuccessful repetition a warning signal may then be displayed.
The dialogue between the transponder and base station may also carry out an admission identification in both directions. Thus for example the transponder after ascertaining the authorisation of the base station for deactivation/reactivation with an analogous or another method, may display its authorisation, record protected data or likewise for storing or prove its correct origin (authentication).
As indicated above for the base station there are also applied the terms xe2x80x9cread apparatusxe2x80x9d or xe2x80x9creaderxe2x80x9d. This term is probably allocated historically since earlier the transponder was indeed merely extracted, thus xe2x80x9creadxe2x80x9d. Today the base stations, as described above, fulfill many functions such as for example transmitting information, receiving information, processing information etc. For this reason in the above description the more general term xe2x80x9cbase stationxe2x80x9d is preferred. For the sake of simplicity and without limiting the generality, in the subsequent description of the figures the terms xe2x80x9cread apparatusxe2x80x9d or xe2x80x9creaderxe2x80x9d are used.